Last Access time stamp for users after SAML login

Note that the Drupal Core part of the login process is doing the timestamp-setting; not the samlauth module. I don't know what's the issue, but - two things to consider:

1)
My first thought is: are you really logging into Drupal? If you're hitting the IdP -> samlauth ACS endpoint but then it turns out you're already logged into Drupal... you're not actually being logged in, and the timestamp is not updated. I see that as "same behavior as Drupal Core": if you're already logged in and then browse to /user/login, the timestamp is also not updated.

I get that "2 months 3 weeks ago" is a long time, so that's probably not it. But it's the most obvious explanation, to mention first. (If it is: let's convert this to a 'Support Request' and keep it open, it's has a good issue title.)

If you do have a reason to have the timestamp updated every time a user enters through the ACS (as opposed to actually logging in to Drupal)... that would be an extra configurable option (or local patch).

2)
Debug.

The code path from /samlauth/acs is:

• SamlService::acs() -> inescapably calls SamlService::doLogin(),
• which contains two calls to ExternalAuth::userLoginFinalize() (one for new users, one for existing users)
• which calls user_login_finalize(), first thing,
• which updates the timestamp, first thing.

So I actually don't know how you could log in but not have the timestamp updated.